JMicron JMB363 Add-on Card AHCI mode

The JMicron JMB363 is a 2-port SATA + 1-port PATA controller chip often found embedded in motherboards and in low-cost add-on cards. The chip supports operating in IDE, AHCI, and RAID controller modes. Motherboard BIOSes allow choosing the operating mode, but add-on cards are stuck in RAID mode.

The problem with RAID mode is that standard AHCI drivers cannot be used. A JMicron-specific driver is available only for Windows. Some OSes (Linux, drivers/pci/quirks.c) set a PCI configuration register to put the controller into AHCI+IDE mode after booting and use standard drivers. Other OSes (Mac OS X) do nothing and can’t use the card.

I attempt to solve this problem by hacking the JMB363 option ROM to put the card into AHCI mode, with partial success. The two SATA ports work in OS X, including hot-plugging, but I could not get the parallel ATA enabled, and I had to bypass loading the option ROM (thus, can’t boot from the SATA ports anymore). The patched ROM might also be useful for other OSes that don’t have Linux-style PCI quirks.

Hacking the Option ROM

I used the newest version of the option ROM (1.07.24) posted at JMicron’s FTP site. Some hints about the configuration of the JMB363 can be found in JMicron’s release notes, particularly about PCI configuration register 0xdf. The release notes hints at the existence of a newer 1.07.28, but it wasn’t posted. Linux’s drivers/pci/quirks.c gave some hints about the meaning of PCI configuration register 0x40-43.

Configuration Register 0xDF

PCI configuration register 0xdf seems to be intended for main BIOS to communicate its settings to the option ROM, rather than having a direct effect on the hardware. Bits [1:0] seem to indicate controller mode. Bits [7:6] and [5:4] look like they control two instances of the same thing because the code that parses them is structured the same way. The release notes say bit [6] is used to put the chip into “multi-function” mode with the option ROM disabled, which feels a little bit like a hack to me. Bits [3:2] don’t appear to be used.

df[6]

df[1:0]

Result

0

00

Default, RAID mode

0

01

IDE device (class 0101)

0

10

AHCI device (class 0106)

0

11

IDE device (class 0101)

1

00

RAID device (class 0104), no option ROM

1

01

AHCI device (class 0106), no option ROM

1

10

AHCI device (class 0106), no option ROM

1

11

AHCI device (class 0106), no option ROM

It seems like bits [1:0] select the card mode (RAID, IDE, AHCI, IDE?), with the value 2’b11 probably not intended to be used (the option ROM code only distinguishes between 2’b00, 2’b01, and other).

Since setting df[6] causes “jump out of Option ROM, do nothing” (See release notes for v1.03), it is no longer possible to boot from any disks attached to the chip.

In no case did setting 0xdf[6] cause the JMB363 to become a multi-function device. I speculate its purpose is to disable the option ROM, allowing the main BIOS to set up the rest of the device configuration without interference.

Register df[6] is used by the option ROM code at offset 0x3517.

Registers df[7:6] and df[5:4] are used at offsets 0x372d and 0x3756, respectively. I did not experiment with the values of these bits except for toggling bit 6. They seem important, causing PCI config register bits 0xed[5:2] and 0xcd[5:2] to be set when df[7:6] and df[5:4], respectively, is 2’b01 or 2’b10.

Register df[1:0] is used in the option ROM at offset 0x3553, 0x3574, and 0x37c1

Configuration Register 0x40-43

These configuration registers seem to control the hardware directly. The option ROM sets them but doesn’t read them.

Register

Function

43

Defaults to 0x80. Unknown purpose.

42

Seems to take values of 0xc2 or 0x82. Bits [1:0] depends on 0xdf[1:0], with a special case when 0xdf[6] is set. Unknown purpose.

Bit 1 appears to control whether the second PCI function is enabled. Other bits unknown.

Linux (drivers/pci/quirks.c) modifies this configuration register, which results in 0x80c2a1bf on my card. I tried modifying the option ROM to also configure register 0x40-43 to this value, but had many problems booting. Either I’m getting some of the other configuration bytes wrong or this value is intended only to be used after booting the system.

Problems

Only modifying register df[1:0] to value 2’b10 seems to put the controller into AHCI mode (with no IDE PCI function, but PATA drives are still detected by the option ROM). The option ROM loads, correctly reports connected drives, and allows booting from them. However, OS X does not detect hard drives that were detected by the option ROM at boot time. If SATA drives are not attached until after the option ROM loads, they are detected by the OS and can be hot-plugged. Therefore, I chose to set register df[6] to cause the option ROM to quit without detecting drives. A side-effect is that without the option ROM, the computer can’t boot from the disks.

The problems with configuration register 0x40-43 are more problematic.

Linux sets register 0x41 to 0xa1, while the option ROM will set it to 0xf1 or 0x51. 0x51 appears to disable hot-plugging the disks on the SATA channels entirely. 0xa1 causes a hang for several minutes at boot, seemingly trying and failing to find a disk, while using 0xf1 boots normally. Trying with 0xb1 and 0xe1 shows the same behaviour as for 0xa1, but hangs only if a disk is not present on SATA0 or SATA1, respectively. Thus it seems like setting 0x41[7:6] or 0x41[5:4] to 2’b10 causes the option ROM to assert that a disk must be present at boot time for that channel. The hang does not occur if the option ROM is skipped by setting 0xdf[6], so I use 0xa1 to be closer to what Linux does, although I notice no other differences between 0xf1 and 0xa1.

Linux sets register 40 bit 2 (to enable the IDE port?). Trying to do that in the option ROM causes a several-minute hang during boot when loading the option ROM (again, seemingly waiting for a disk and giving up), even when a PATA disk is present. With df[6] set, the option ROM does not detect any disks, despite spending several minutes.

Final configuration

PATA not enabled because turning it on causes a hang during boot.

Option ROM not enabled by setting df[6], so the disks are not bootable.

SATA drives working in OS X with the standard AHCI driver, including hot-plugging.

56 comments to JMicron JMB363 Add-on Card AHCI mode

hi, i installed your ahci_skiprom bin on my jmb363. seems ok, but i wanted to play around with a few more settings. when i made further modifications and went to install, the flash app found no flash chip. the skip rom option seems to completely disable the flashrom leaving the card unable to update. any ideas how i can regain access to the flashrom short of desoldering and reprogramming? thanks.

hmm… I didn’t have problems flashing back and forth between them, regardless of whether the option ROM was loaded.

I did have some issues with the card being seated properly in the PCIe slot. Make sure the card is detected at boot time (it should show up on an older BIOS that prints out all the PCI devices at boot. I also used pcicfg in DOS to check the card was detected). Hot-plugging the PCIe card never worked for me.

you were 100% correct. re-seated the card and able to flash again. who would have thought… not me obviously. thanks. BTW i am trying to set ide mode so i simply changed the 3 instances of b1 to 91 (trying to put sata interface into legacy mode) and set the checksum. does this sound correct to you?

I don’t understand. Which three instances of 0xb1, and why change to 0x91?

Is tricking the option ROM into seeing register df[6]=0, df[1:0]=01 the result you want? (and letting the option ROM decide how to set the other configuration registers)

If so, I would start with the first patched ROM (the one that sets df[1:0] to 10), and change that to 01. I made changes at three locations: offset 0x3556, 0x3577, and 0x37c4. I replaced 3 bytes with (b1 02 90): b1 02 mov cl, 0x02
90 nop

Those three bytes used to be a function call to a function that would read a byte from the PCI configuration space register (di), and return the result in cl.

maybe i missed something, i started with the ahci file, and did a simple hex compare to the original (i dont have proper tools for dis), i found only the 3 differences you wrote about (though my hex editor has a slightly different addy) so i started looking at the binary values, b1 (10110001 binary) seemed to be the bytes that referred to the bits 1:0 so i just changed them to read 01 (10010001 binary) converted back to hex which came out to 91 instead of b1. so i changed the strings to read 91 02 90. i assumed this would put 01 in the cfg register and set ide/legacy mode.

though now i am thinking i need to change it instead to 01110001 or 71h. hopefully you could shed a bit more light on the subject. thanks

The edits are in x86 machine code. They’re not register values. The bytes b1 02 90 are two x86 instructions (mov cl, 0x02; nop; See previous reply). The original bytes were e8 xx xx, where e8 is the opcode for the CALL instruction, and the 16-bit immediate operand is the relative branch target.

I’m not changing the configurations registers, I’m modifying the code that reads the registers. You’d probably need a disassembler to understand the code…

I haven’t tried using the IDE port, and neither of the modified ROMs I posted would work. I suspect it’s what steve asked for in the above comments (unsure if it boots though).

In that case, it was taking the first modified ROM (without bypassing the option ROM, since you do want to boot), then editing it to put the device into IDE mode rather than AHCI mode. (Change three instances of b1 02 to b1 01)

Hello, I used the first patch (ACHI mode) in hackintosh. I have two HDD conect. But my BIOS detects one disk connected via SATA and other via IDE. In Mac I can not see this HDD (IDE). Your patch nullified IDE mode and I have the HDDs connected via SATA. Why can it be?.

Hello, I’ve tried both patch. Skiprom works best for me in hackintosh. But I still have not managed to create a raid from the card (RAID1 for use from mac and windows, with SATA disks). You know if it is possible?.
thanks

Many thanks for the modded ROM. I have programmed the first modded one into two JMB 363 cards with SST flashable chip and everything has gone OK. It puts the controller into AHCI mode (0106 class, original was 0104 class) and it is bootable (tested actually, with only SATA drives).

Anyway, you can erase the flash chip, so that no option ROM is executed and the card is rendered non-bootable anymore. Even with no option ROM loaded, the card is still recognized under the Windows OS as a generic AHCI controller (0106 class).

Could you pass on a link please of your setup? i’m not savvy with configuring things, but i can use that command flashing tool, i would like to simply use the card as a sata controller. that can boot, but my bios only shows it as a raid adapter, and the drivers during windows 7 install fails.

i feel it is because i am only using one drive with this card. and it is ment for Raid setups.

could your bios config allow me to use ahci to boot my one drive (through sata) and allow for windows install?

I tried to change b1 02 to b1 01 to make the card work in IDE/Legacy mode, changing these values produce a corrupt ROM file that can not be flashed to the add-on card. Do i need to fix a checksum value as well? What value?

How did you find out which bytes in the bin file is the PCI config register?

I’m trying to do the same for the Marvell 9128 option ROM. Specifically, I need to disable option ROM and get it to boot up in AHCI mode. The PCI config registers on the Marvell would be entirely different to the JMicron, so without some info from the manufacturer, I’d be stabbing in the dark. Any pointers would be appreciated.

I had some help from the option ROM release notes, which gave some hints as to what the PCI config registers do (or at least, supposed to do after being interpreted by the option ROM). You might try looking through the Linux kernel sources to see if the driver for the 88SE9128 gives any clues as to how the chip works…

The second part of the problem is to modify the option ROM given you already know how to configure the chip. This was done by disassembling the option ROM (it’s real mode x86 code) to figure out what it does. The bytes that were changed here are x86 code that reads the PCI configuration register and does something with the value. It is not a data table containing some form of initial register values.

I contacted jMicron’s support to ask if they had an official NON-RAID rom, guess what, they had…

The NON-RAID part works fine but the add-on card is still recognized as RAID controller, Below you can find the ‘official’ NON-RAID rom.
Anyway to modify it to force it to be recognized as ‘Standard Dual Channel PCI IDE Controller’ or ‘Standard AHCI 1.0 Serial ATA Controller’ by default?

I know you do not have this card anymore. but I would still ask for some support.

I’ve bought the jmb363 version of this card, with 2 sata ports, and no IDE ports.

it seems to be fixed to Raid, and the bios sees the drive connected as a raid controller.

during a windows fresh setup, i cannot get past the copying and expanding files without errors. (i believe the drivers are not compatible with the raid configuration)

i only have one drive i wish to use on the card. (and a sata dvd writer on the other port)

and want to be able to use the card as a boot device to boot windows, and to avoid using my onboard sata controller. bios is able to see the card and drive, but windows after using the drivers still error out.

the drive is sound, and the DVD of windows is original and has been used before to istall, even using the onboard sata port i can install without problems, so i know the issue is not the DVD, or the DVD drive (The install drive is IDE and i’m using the onboard ide for the installation) or the HDD, as all these have been correctly tested to be working.

i understand of your busy, if you could direct me to a Bios i could flash that will allow my drive to be usable as a boot device through the JMB363, i would be forever grateful.

It seems the setup that Pablo above has is what i’m looking for but i’m unsure of this.

Hi,
It may be useful to know that on some cards equipped with JMB363, for example the card marked “PESA111R”, the description is misleading: There are effectively two sockets for connecting an external HDD, one INTERNAL, classical SATA, and another one, EXTERNAL, e-SATA, but they are EXCLUSIVE: if you use one, you cannot use the other one at the same time. Actually, there is only one sata connexion, not two.

I have read through this page and start to comprehend the edits needed. v1.08.01 is a different size and has different offsets for the necessary edits. Unfortunately, I do not know enough about hex editing to find where to patch.

The first thing that’s different with the on-motherboard controllers is that the option ROM is usually packaged into the system BIOS, rather than being on its own flash chip. So at minimum, you’d probably need to extract and insert the option ROM and flash your system BIOS, rather than using the flashing procedure for the add-on card.

Other than that, I’m not certain if the option ROMs are the same for both on-motherboard and add-on card devices. They might be similar enough you could replace one with the other, but they also might not be.

themiron’s 1.07.28 works perfectly as AHCI mode SATA controller. I have been using it for some time.
the issue i have is 1.08.01 operates faster and gets better benchmarks. I want to create an AHCI patched verson of 1.08.01.
Unfortunately, the file is quite different. Given my limited abilities to understand hex, I cannot locate where to apply the changes to.